HALO IQ Data Processing Addendum

Effective January 1, 2026 · Part of the HALO IQ Terms of Service · https://handbookiq.ai/legal/dpa

1. Scope, roles and definitions

This Data Processing Addendum ("DPA") is part of the HALO IQ Terms of Service (the "Terms") between Halo IQ LLC ("HALO IQ") and the customer ("Customer"), and applies whenever HALO IQ processes Personal Information contained in Customer Data on Customer's behalf. Capitalized terms not defined here have the meaning in the Terms.

Roles. Customer is the business (and, where Customer is a PEO, broker or consultant serving Client Companies, the service provider or contractor to those Client Companies). HALO IQ is Customer's service provider and contractor under the CCPA and a processor under other applicable privacy laws. Customer is responsible for the lawfulness of its collection and disclosure of Personal Information to HALO IQ and for the instructions it gives.

Definitions. "Personal Information," "Business," "Service Provider," "Contractor," "Sell," "Share," "Consumer" and "Business Purpose" have the meanings in the CCPA, Cal. Civ. Code 1798.100 et seq., and its regulations, and comparable terms under other applicable U.S. state privacy laws. "Security Incident" means a confirmed unauthorized access to, or acquisition, disclosure or loss of, Personal Information in HALO IQ's possession or control. "Subprocessor" means a third party HALO IQ engages to process Personal Information on Customer's behalf.

2. Processing instructions and service-provider obligations

HALO IQ will process Personal Information only for the Business Purposes of providing, securing, supporting and improving the Services as described in the Terms, the Documentation and Customer's configuration and use of the Services, which together are Customer's complete instructions, and as required by law. Improvement is limited to the de-identified and aggregated uses the Terms allow and to internal uses to build or improve the Services that do not include building profiles of individuals or correcting data across customers, as the CCPA regulations permit.

HALO IQ will not: (a) Sell or Share Personal Information; (b) retain, use or disclose it for any purpose other than the Business Purposes, including any commercial purpose of its own; (c) retain, use or disclose it outside the direct business relationship with Customer; or (d) combine it with Personal Information received from another source, except as the CCPA regulations allow. HALO IQ certifies that it understands these restrictions and will comply with them.

HALO IQ will notify Customer within 10 business days if it determines it can no longer meet its obligations under applicable privacy law. Customer may, on reasonable notice, take steps to stop and remediate unauthorized use of Personal Information, including suspending the affected processing. If HALO IQ believes an instruction violates law, it will tell Customer and may suspend that instruction until resolved.

3. Subprocessors, security, personnel and Security Incidents

Subprocessors. Customer authorizes the Subprocessors listed at https://handbookiq.ai/legal/subprocessors. HALO IQ will give at least 15 days' notice (by updating that page and emailing account owners who subscribe to notices) before adding a Subprocessor that will process Customer's Personal Information; Customer may object in writing on reasonable data-protection grounds within that period, and if the parties cannot resolve the objection, Customer may terminate the affected Services with a pro-rata refund of prepaid fees. HALO IQ binds each Subprocessor to written terms no less protective than this DPA and remains responsible for their performance. AI-model providers are engaged on terms that prohibit training general-purpose models on Customer's Personal Information.

Security. HALO IQ maintains a written security program with administrative, technical and physical safeguards appropriate to the risk, including: encryption of Personal Information in transit (TLS 1.2 or higher) and at rest; logical tenant isolation with row-level access control; role-based access and least privilege; multi-factor authentication for administrative access; logging and monitoring; secure development practices and dependency scanning; backups and recovery procedures; vendor due diligence; and annual review of the program. HALO IQ will provide a summary of its program and, where available, third-party assessment reports on request under confidentiality.

Personnel. HALO IQ limits access to personnel who need it, binds them to confidentiality, and trains them on data protection.

Security Incidents. HALO IQ will notify Customer without undue delay, and in any case within 72 hours of confirming a Security Incident affecting Customer's Personal Information, with the information reasonably available: nature and scope, categories and approximate number of individuals and records, likely consequences, and measures taken. HALO IQ will cooperate with Customer's reasonable investigation and remediation. Notice is not an admission of fault. Customer is responsible for notices to individuals, Client Companies and regulators that the law requires of it, and HALO IQ will assist at Customer's reasonable request.

4. Individual requests, audits, return and deletion, liability

Individual requests. HALO IQ will forward to Customer, within 5 business days, any request it receives from an individual about Personal Information processed for Customer, and will not respond except to direct the individual to Customer. HALO IQ provides export, correction and deletion tools in the Services and will give reasonable additional assistance at Customer's request, at Customer's cost where the effort is material.

Assessments and audits. HALO IQ will give Customer the information reasonably needed to demonstrate compliance with this DPA and to complete risk assessments, through its security summary, questionnaires and available third-party reports. Not more than once a year, or after a Security Incident, Customer may conduct a remote audit on 30 days' notice, during business hours, under confidentiality, without access to other customers' data, at Customer's expense.

Return and deletion. During the term and for 30 days after it ends, Customer may export Personal Information through the Services. After that period HALO IQ deletes or de-identifies Personal Information, except for backups purged on their regular schedule (not more than 90 days) and records HALO IQ must keep by law, which stay subject to this DPA. HALO IQ will confirm deletion in writing on request.

Liability. Each party's liability under this DPA is subject to the exclusions and cap in the Terms, treated together with liability under the Terms as a single cap.

Order of precedence. This DPA controls over the Terms for the processing of Personal Information. Where other applicable privacy laws require additional terms, the parties will execute them, and HALO IQ's standard terms for those laws apply in the meantime. This DPA ends when HALO IQ has deleted or returned all Personal Information.

Annex: details of processing